As a rule, you do not struggle to detect incidents. You struggle to classify them consistently. A ransomware incident is assessed as high severity. A similar incident a few months later receives a ...